Smarty v4.5.2 update

ReadMe.md

@@ -11,45 +11,36 @@ For local install only
 
 ## Setup from central composer
 
-| Host | Location | Type |
+Setup from gitea internal servers
-| - | - | - |
-| composer.tokyo.tequila.jp | soba-local | Local test |
-| composer-local.tokyo.tequila.jp | udon-local | Local Live, no https |
-| composer.egplusww.jp | udon | General Live (use this) |
 
-composer.json:
+```sh
-
+composer config repositories.git.egplusww.jp.Composer composer https://git.egplusww.jp/api/packages/Composer/composer
-For Local test, note that secure-http has to be turned off:
-
-```json
-{
-    "repositories": [
-        {
-            "type": "composer",
-            "url": "http://composer.tokyo.tequila.jp"
-        }
-    ],
-    "require": {
-        "egrajp/smarty-extended": "@dev"
-    },
-    "config": {
-        "secure-http": false
-    }
-}
 ```
 
-For live settings
+Alternative setup composer local zip file repot:
+`composer config repositories.composer.egplusww.jp composer http://composer.egplusww.jp`
 
-```json
+## Install package
-{
+
-    "repositories": [
+`composer require egrajp/smarty-extended:^4.3`
-        {
+
-            "type": "composer",
+## How to update
-            "url": "https://composer.egplusww.jp"
+
-        }
+1) update the original composer for ^4.3
-    ],
+2) copy over the src/sysplugins and all base files in src/
-    "require": {
+3) check either function.html_checkboxes.php and function.html_options.php have changed
-        "egrajp/smarty-extended": "@dev"
+4) copy src/plugins except the above two files, be sure to keep the block.t.php and function_popup*.php
-    }
+5) Create new release version as official relase number
-}
+
-```
+## Updated files (different from master)
+
+### New
+
+`src/plugins/block.t.php`
+`src/plugins/function_popup.php`
+`src/plugins/function_popup.init.php`
+
+### Changed
+
+`src/plugins/function.html_checkboxes.php`
+`src/plugins/function.html_options.php`

publish/.gitignore

@@ -0,0 +1 @@
+.env*

publish/last.published

@@ -0,0 +1 @@
+4.5.1

publish/package-download/.gitignore

@@ -0,0 +1 @@
+*.zip

publish/publish.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+
+BASE_FOLDER=$(dirname $(readlink -f $0))"/";
+PACKAGE_DOWNLOAD="${BASE_FOLDER}package-download/";
+if [ ! -d "${PACKAGE_DOWNLOAD}" ]; then
+     mkdir "${PACKAGE_DOWNLOAD}";
+fi;
+VERSION=$(git tag --list | sort -V | tail -n1 | sed -e "s/^v//");
+file_last_published="${BASE_FOLDER}last.published";
+go_flag="$1";
+
+if [ -z "${VERSION}" ]; then
+     echo "Version must be set in the form x.y.z without any leading characters";
+     exit;
+fi;
+# compare version, if different or newer, deploy
+if [ -f "${file_last_published}" ]; then
+     LAST_PUBLISHED_VERSION=$(cat ${file_last_published});
+     if $(dpkg --compare-versions "${VERSION}" le "${LAST_PUBLISHED_VERSION}"); then
+          echo "git tag version ${VERSION} is not newer than previous published version ${LAST_PUBLISHED_VERSION}";
+          exit;
+     fi;
+fi;
+
+# read in the .env.deploy file and we must have
+# GITEA_UPLOAD_FILENAME
+# GITLAB_USER
+# GITLAB_TOKEN
+# GITLAB_URL
+# GITEA_USER
+# GITEA_DEPLOY_TOKEN
+# GITEA_URL_DL
+# GITEA_URL_PUSH
+if [ ! -f "${BASE_FOLDER}.env.deploy" ]; then
+     echo "Deploy enviroment file .env.deploy is missing";
+     exit;
+fi;
+set -o allexport;
+cd ${BASE_FOLDER};
+source .env.deploy;
+cd -;
+set +o allexport;
+
+if [ "${go_flag}" != "go" ]; then
+     echo "No go flag given";
+     echo "Would publish ${VERSION}";
+     echo "[END]";
+     exit;
+fi;
+
+echo "[START]";
+
+# gitea
+if [ ! -z "${GITEA_UPLOAD_FILENAME}" ] &&
+     [ ! -z "${GITEA_URL_DL}" ] && [ ! -z "${GITEA_URL_PUSH}" ] &&
+     [ ! -z "${GITEA_USER}" ] && [ ! -z "${GITEA_TOKEN}" ]; then
+     curl -LJO \
+          --output-dir "${PACKAGE_DOWNLOAD}" \
+          ${GITEA_URL_DL}/v${VERSION}.zip;
+     # echo "curl -LJO \
+     #      --output-dir "${PACKAGE_DOWNLOAD}" \
+     #      ${GITEA_URL_DL}/v${VERSION}.zip;"
+     curl --user ${GITEA_USER}:${GITEA_TOKEN} \
+          --upload-file "${PACKAGE_DOWNLOAD}${GITEA_UPLOAD_FILENAME}-v${VERSION}.zip" \
+          ${GITEA_URL_PUSH}?version=${VERSION};
+     # echo "curl --user ${GITEA_USER}:${GITEA_TOKEN} \
+     #      --upload-file "${PACKAGE_DOWNLOAD}${GITEA_UPLOAD_FILENAME}-v${VERSION}.zip" \
+     #      ${GITEA_URL_PUSH}?version=${VERSION};"
+     echo "${VERSION}" > "${file_last_published}";
+else
+     echo "Missing either GITEA_UPLOAD_FILENAME, GITEA_URL_DL, GITEA_URL_PUSH, GITEA_USER or GITEA_TOKEN environment variable";
+fi;
+
+# gitlab
+if [ ! -z "${GITLAB_URL}" ] && [ ! -z  "${GITLAB_DEPLOY_TOKEN}" ]; then
+     curl --data tag=v${VERSION} \
+          --header "Deploy-Token: ${GITLAB_DEPLOY_TOKEN}" \
+          "${GITLAB_URL}";
+     curl --data branch=master \
+          --header "Deploy-Token: ${GITLAB_DEPLOY_TOKEN}" \
+          "${GITLAB_URL}";
+     echo "${VERSION}" > "${file_last_published}";
+else
+     echo "Missing GITLAB_DEPLOY_TOKEN environment variable";
+fi;
+
+echo "";
+echo "[DONE]";
+
+# __END__

src/Smarty.class.php

@@ -107,7 +107,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '4.3.0';
+    const SMARTY_VERSION = '4.5.1';
     /**
      * define variable scopes
      */

src/debug.tpl

@@ -167,9 +167,7 @@
     </html>
 {/capture}
 <script type="text/javascript">
-    {$id = '__Smarty__'}
+    _smarty_console = window.open("", "console{$targetWindow}", "width=1024,height=600,left={$offset},top={$offset},resizable,scrollbars=yes");
-    {if $display_mode}{$id = "$offset$template_name"|md5}{/if}
-    _smarty_console = window.open("", "console{$id}", "width=1024,height=600,left={$offset},top={$offset},resizable,scrollbars=yes");
     _smarty_console.document.write("{$debug_output|escape:'javascript' nofilter}");
     _smarty_console.document.close();
 </script>

src/plugins/function.math.php

@@ -67,7 +67,7 @@ function smarty_function_math($params, $template)
     $equation = preg_replace('/\s+/', '', $equation);
 
     // Adapted from https://www.php.net/manual/en/function.eval.php#107377
-    $number = '(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
+    $number = '-?(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
     $functionsOrVars = '((?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*))';
     $operators = '[,+\/*\^%-]'; // Allowed math operators
     $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)*\)|\((?1)*\)))(?:'.$operators.'(?1))?)+$/';

src/plugins/modifier.escape.php

@@ -115,7 +115,9 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
                     // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
                     '<!--' => '<\!--',
                     '<s'   => '<\s',
-                    '<S'   => '<\S'
+                    '<S'   => '<\S',
+	                "`" => "\\\\`",
+	                "\${" => "\\\\\\$\\{"
                 )
             );
         case 'mail':

src/plugins/modifier.implode.php

@@ -0,0 +1,15 @@
+<?php
+/**
+ * Smarty plugin
+ *
+ * @package    Smarty
+ * @subpackage PluginsModifier
+ */
+
+function smarty_modifier_implode($values, $separator = '')
+{
+	if (is_array($separator)) {
+		return implode((string) ($values ?? ''), (array) $separator);
+	}
+	return implode((string) ($separator ?? ''), (array) $values);
+}

src/plugins/modifier.truncate.php

@@ -26,7 +26,7 @@
  */
 function smarty_modifier_truncate($string, $length = 80, $etc = '...', $break_words = false, $middle = false)
 {
-    if ($length === 0) {
+    if ($length === 0 || $string === null) {
         return '';
     }
     if (Smarty::$_MBSTRING) {

src/plugins/modifiercompiler.count_characters.php

@@ -25,8 +25,8 @@ function smarty_modifiercompiler_count_characters($params)
         return 'preg_match_all(\'/[^\s]/' . Smarty::$_UTF8_MODIFIER . '\',' . $params[ 0 ] . ', $tmp)';
     }
     if (Smarty::$_MBSTRING) {
-        return 'mb_strlen(' . $params[ 0 ] . ', \'' . addslashes(Smarty::$_CHARSET) . '\')';
+        return 'mb_strlen((string) ' . $params[ 0 ] . ', \'' . addslashes(Smarty::$_CHARSET) . '\')';
     }
     // no MBString fallback
-    return 'strlen(' . $params[ 0 ] . ')';
+    return 'strlen((string) ' . $params[ 0 ] . ')';
 }

src/plugins/modifiercompiler.count_words.php

@@ -27,5 +27,5 @@ function smarty_modifiercompiler_count_words($params)
                $params[ 0 ] . ', $tmp)';
     }
     // no MBString fallback
-    return 'str_word_count(' . $params[ 0 ] . ')';
+    return 'str_word_count((string) ' . $params[ 0 ] . ')';
 }

src/plugins/modifiercompiler.escape.php

@@ -64,7 +64,9 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile
                 // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
                 return 'strtr((string)' .
                        $params[ 0 ] .
-                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))';
+                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", 
+                       "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S",
+                       "`" => "\\\\`", "\${" => "\\\\\\$\\{"))';
         }
     } catch (SmartyException $e) {
         // pass through to regular plugin fallback

src/plugins/modifiercompiler.json_encode.php

@@ -0,0 +1,11 @@
+<?php
+
+/**
+ * Smarty plugin
+ *
+ * @package    Smarty
+ * @subpackage PluginsModifierCompiler
+ */
+function smarty_modifiercompiler_json_encode($params) {
+	return 'json_encode(' . $params[0] . (isset($params[1]) ? ', (int) ' . $params[1] : '') . ')';
+}

src/plugins/modifiercompiler.lower.php

@@ -22,8 +22,8 @@
 function smarty_modifiercompiler_lower($params)
 {
     if (Smarty::$_MBSTRING) {
-        return 'mb_strtolower(' . $params[ 0 ] . ', \'' . addslashes(Smarty::$_CHARSET) . '\')';
+        return 'mb_strtolower((string) ' . $params[ 0 ] . ', \'' . addslashes(Smarty::$_CHARSET) . '\')';
     }
     // no MBString fallback
-    return 'strtolower(' . $params[ 0 ] . ')';
+    return 'strtolower((string) ' . $params[ 0 ] . ')';
 }

src/plugins/modifiercompiler.strip_tags.php

@@ -21,7 +21,7 @@
 function smarty_modifiercompiler_strip_tags($params)
 {
     if (!isset($params[ 1 ]) || $params[ 1 ] === true || trim($params[ 1 ], '"') === 'true') {
-        return "preg_replace('!<[^>]*?>!', ' ', {$params[0]} ?: '')";
+        return "preg_replace('!<[^>]*?>!', ' ', (string) {$params[0]})";
     } else {
         return 'strip_tags((string) ' . $params[ 0 ] . ')';
     }

src/plugins/modifiercompiler.substr.php

@@ -0,0 +1,12 @@
+<?php
+
+/**
+ * Smarty plugin
+ *
+ * @package    Smarty
+ * @subpackage PluginsModifierCompiler
+ */
+function smarty_modifiercompiler_substr($params) {
+	return 'substr((string) ' . $params[0] . ', (int) ' . $params[1] .
+		(isset($params[2]) ? ', (int) ' . $params[2] : '') . ')';
+}

src/plugins/modifiercompiler.upper.php

@@ -21,8 +21,8 @@
 function smarty_modifiercompiler_upper($params)
 {
     if (Smarty::$_MBSTRING) {
-        return 'mb_strtoupper(' . $params[ 0 ] . ' ?? \'\', \'' . addslashes(Smarty::$_CHARSET) . '\')';
+        return 'mb_strtoupper((string) ' . $params[ 0 ] . ' ?? \'\', \'' . addslashes(Smarty::$_CHARSET) . '\')';
     }
     // no MBString fallback
-    return 'strtoupper(' . $params[ 0 ] . ' ?? \'\')';
+    return 'strtoupper((string) ' . $params[ 0 ] . ' ?? \'\')';
 }

src/plugins/outputfilter.trimwhitespace.php

@@ -62,7 +62,7 @@ function smarty_outputfilter_trimwhitespace($source)
         }
     }
     $expressions = array(// replace multiple spaces between tags by a single space
-                         // can't remove them entirely, becaue that might break poorly implemented CSS display:inline-block elements
+                         // can't remove them entirely, because that might break poorly implemented CSS display:inline-block elements
                          '#(:SMARTY@!@|>)\s+(?=@!@SMARTY:|<)#s'                                    => '\1 \2',
                          // remove spaces between attributes (but not in attribute values!)
                          '#(([a-z0-9]\s*=\s*("[^"]*?")|(\'[^\']*?\'))|<[a-z0-9_]+)\s+([a-z/>])#is' => '\1 \5',

src/plugins/shared.escape_special_chars.php

@@ -20,7 +20,7 @@
 function smarty_function_escape_special_chars($string)
 {
     if (!is_array($string)) {
-        $string = htmlspecialchars($string, ENT_COMPAT, Smarty::$_CHARSET, false);
+        $string = htmlspecialchars((string) $string, ENT_COMPAT, Smarty::$_CHARSET, false);
     }
     return $string;
 }

src/plugins/variablefilter.htmlspecialchars.php

@@ -15,5 +15,5 @@
  */
 function smarty_variablefilter_htmlspecialchars($source, Smarty_Internal_Template $template)
 {
-    return htmlspecialchars($source, ENT_QUOTES, Smarty::$_CHARSET);
+    return htmlspecialchars((string) $source, ENT_QUOTES, Smarty::$_CHARSET);
 }

src/sysplugins/smarty_internal_compile_private_modifier.php

@@ -109,9 +109,11 @@ class Smarty_Internal_Compile_Private_Modifier extends Smarty_Internal_CompileBa
                             if (!is_object($compiler->smarty->security_policy)
                                 || $compiler->smarty->security_policy->isTrustedPhpModifier($modifier, $compiler)
                             ) {
-                                trigger_error('Using php-function "' . $modifier . '" as a modifier is deprecated and will be ' .
+                                if (!in_array($modifier, ['time', 'join', 'is_array', 'in_array'])) {
+                                    trigger_error('Using unregistered function "' . $modifier . '" in a template is deprecated and will be ' .
                                         'removed in a future release. Use Smarty::registerPlugin to explicitly register ' .
                                         'a custom modifier.', E_USER_DEPRECATED);
+                                }
                                 $output = "{$modifier}({$params})";
                             }
                             $compiler->known_modifier_type[ $modifier ] = $type;

src/sysplugins/smarty_internal_compile_private_print_expression.php

@@ -93,7 +93,7 @@ class Smarty_Internal_Compile_Private_Print_Expression extends Smarty_Internal_C
                 }
                 // autoescape html
                 if ($compiler->template->smarty->escape_html) {
-                    $output = "htmlspecialchars((string) {$output}, ENT_QUOTES, '" . addslashes(Smarty::$_CHARSET) . "')";
+                    $output = "htmlspecialchars((string) ({$output}), ENT_QUOTES, '" . addslashes(Smarty::$_CHARSET) . "')";
                 }
                 // loop over registered filters
                 if (!empty($compiler->template->smarty->registered_filters[ Smarty::FILTER_VARIABLE ])) {

src/sysplugins/smarty_internal_debug.php

@@ -238,9 +238,12 @@ class Smarty_Internal_Debug extends Smarty_Internal_Data
         $_config_vars = $ptr->config_vars;
         ksort($_config_vars);
         $debugging = $smarty->debugging;
+        $templateName = $obj->source->type . ':' . $obj->source->name;
+        $displayMode = $debugging === 2 || !$full;
+        $offset = $this->offset * 50;
         $_template = new Smarty_Internal_Template($debObj->debug_tpl, $debObj);
         if ($obj->_isTplObj()) {
-            $_template->assign('template_name', $obj->source->type . ':' . $obj->source->name);
+            $_template->assign('template_name', $templateName);
         }
         if ($obj->_objType === 1 || $full) {
             $_template->assign('template_data', $this->template_data[ $this->index ]);
@@ -250,8 +253,8 @@ class Smarty_Internal_Debug extends Smarty_Internal_Data
         $_template->assign('assigned_vars', $_assigned_vars);
         $_template->assign('config_vars', $_config_vars);
         $_template->assign('execution_time', microtime(true) - $smarty->start_time);
-        $_template->assign('display_mode', $debugging === 2 || !$full);
+        $_template->assign('targetWindow', $displayMode ? md5("$offset$templateName") : '__Smarty__');
-        $_template->assign('offset', $this->offset * 50);
+        $_template->assign('offset', $offset);
         echo $_template->fetch();
         if (isset($full)) {
             $this->index--;

src/sysplugins/smarty_internal_errorhandler.php

@@ -17,6 +17,12 @@ class Smarty_Internal_ErrorHandler
      */
     public $allowUndefinedVars = true;
 
+    /**
+     * Allows {$foo->propName} where propName is undefined.
+     * @var bool
+     */
+    public $allowUndefinedProperties = true;
+
     /**
      * Allows {$foo.bar} where bar is unset and {$foo.bar1.bar2} where either bar1 or bar2 is unset.
      * @var bool
@@ -80,8 +86,15 @@ class Smarty_Internal_ErrorHandler
             return; // suppresses this error
         }
 
+        if ($this->allowUndefinedProperties && preg_match(
+                '/^(Undefined property)/',
+                $errstr
+            )) {
+            return; // suppresses this error
+        }
+
         if ($this->allowUndefinedArrayKeys && preg_match(
-            '/^(Undefined index|Undefined array key|Trying to access array offset on value of type)/',
+            '/^(Undefined index|Undefined array key|Trying to access array offset on)/',
             $errstr
         )) {
             return; // suppresses this error

src/sysplugins/smarty_internal_templatecompilerbase.php

@@ -640,6 +640,17 @@ abstract class Smarty_Internal_TemplateCompilerBase
                         return $func_name . '(' . $parameter[ 0 ] . ')';
                     }
                 } else {
+
+					if (
+						!$this->smarty->loadPlugin('smarty_modifiercompiler_' . $name)
+						&& !isset($this->smarty->registered_plugins[Smarty::PLUGIN_MODIFIER][$name])
+						&& !in_array($name, ['time', 'join', 'is_array', 'in_array'])
+					) {
+						trigger_error('Using unregistered function "' . $name . '" in a template is deprecated and will be ' .
+							'removed in a future release. Use Smarty::registerPlugin to explicitly register ' .
+							'a custom modifier.', E_USER_DEPRECATED);
+					}
+
 					return $name . '(' . implode(',', $parameter) . ')';
                 }
             } else {

src/sysplugins/smarty_internal_templateparser.php

@@ -2425,6 +2425,9 @@ public static $yy_action = array(
         if (isset($this->smarty->registered_classes[$this->yystack[$this->yyidx + -2]->minor])) {
             $this->_retvalue = $this->smarty->registered_classes[$this->yystack[$this->yyidx + -2]->minor].'::'.$this->yystack[$this->yyidx + 0]->minor[0].$this->yystack[$this->yyidx + 0]->minor[1];
         } else {
+            trigger_error('Using unregistered static method "' . $this->yystack[$this->yyidx + -2]->minor.'::'.$this->yystack[$this->yyidx + 0]->minor[0] . '" in a template is deprecated and will be ' .
+                'removed in a future release. Use Smarty::registerClass to explicitly register ' .
+                'a class for access.', E_USER_DEPRECATED);
             $this->_retvalue = $this->yystack[$this->yyidx + -2]->minor.'::'.$this->yystack[$this->yyidx + 0]->minor[0].$this->yystack[$this->yyidx + 0]->minor[1];
         } 
     } else {

src/sysplugins/smarty_security.php

@@ -253,7 +253,7 @@ class Smarty_Security
      *
      * @param string $function_name
      * @param object $compiler compiler object
-     *
+     * @deprecated
      * @return boolean                 true if function is trusted
      */
     public function isTrustedPhpFunction($function_name, $compiler)

src/sysplugins/smarty_template_compiled.php

@@ -85,7 +85,7 @@ class Smarty_Template_Compiled extends Smarty_Template_Resource_Base
      *
      * @param Smarty_Internal_Template $_template
      *
-     * @return string
+     * @return void
      * @throws Exception
      */
     public function render(Smarty_Internal_Template $_template)